CVE-2022-4364

CVE-2022-4364 is a critical command injection vulnerability affecting Teledyne FLIR AX8 devices running firmware versions up to 1.46.16. Specifically, an unauthenticated remote attacker can exploit a flaw in the palette.php component of the web service handler by manipulating the 'palette' argument. This allows for arbitrary command execution on the device, leading to complete compromise of confidentiality, integrity, and availability. While the vulnerability has been publicly disclosed, there is no evidence of active exploitation, nor are there readily available exploit modules in common frameworks like Metasploit or Nuclei, and community discussion is minimal.